Splunk 6.0 Ignoring TZ Offset

trumpjk · ‎11-22-2013

Prior to upgrading to Splunk 6 I had my props.conf configured to specify TZ's for certain host. Since upgrading to splunk 6 I noticed some entries are displaying and ordering in EST and others are still in GMT. Source of the entries are the same, syslog and in this instance I am not using splunkforwarder I am using syslog to forward to indexer. Props.conf I edited is in $SPLUNK_HOME/etc/system/local

trumpjk · ‎11-22-2013

I figured out my problem. I modified format of syslog then edited props.conf to add "%z" to TIME_FORMAT in props.conf:

TIME_FORMAT = %b %d %H:%M:%S %z

Splunk 6.0 Ignoring TZ Offset

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Splunk 6.0 Ignoring TZ Offset

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future